Overview

• The new law requires leading AI developers to publish safety and security protocols and risk evaluations, with updates posted within 30 days of changes.
• Companies must report critical incidents to the California Office of Emergency Services within 15 days, including model-enabled weapons threats, major cyberattacks, loss of model control, and dangerous deceptive behavior found in testing.
• The requirements target large firms and high-capacity systems, applying to developers with more than $500 million in annual revenue and models near the 10^26 FLOPs threshold, with narrow exemptions for smaller startups.
• Enforcement includes civil penalties of up to $1 million per violation by the state Attorney General, and Cal OES will publish anonymized, aggregated annual incident reports beginning in 2027.
• The law takes effect on January 1, 2026, creates the CalCompute public compute framework due January 1, 2027, builds on expert recommendations after last year’s veto of SB 1047, and has drawn mixed industry reactions with Anthropic’s endorsement and trade group opposition.